2026-10-26_f8c9eca391fa577061d2b8c7396f4060_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_f8c9eca391fa577061d2b8c7396f4060_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom
Size 2.5MB
Sample261027-b3crjscd72
SHA256 7323acfec80890951519605076c2c71c5d95dbd69b3889fe654bb0b957652186
MD5 f8c9eca391fa577061d2b8c7396f4060
SHA1 a5088d5650c000fa4f4606e1106bfc825d405c62
SHA512 4a1be840e5cdcba6a8d079242a5f65cf905acb8549628ea917c855a64acc43946d0fed80053b31f369d0eaf7e46249396a2cfe4c2d0bc24f84aeb9c80906bc91
SSDEEP 49152:Lg3shpoawaz1sds5vFQUHR6KKMDPrRCscmo2nsG3AxeW/SzVyo:XwazJDAxGzD
TLSH
T1A9C53A16F64A65ACC15AC0B4834A8A73AA3534CE0B35B9FF05D446393FA9EF41F38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_f8c9eca391fa577061d2b8c7396f4060_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

File Explorer

2026-10-26_f8c9eca391fa577061d2b8c7396f4060_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

.exe 2.5MB

2026-10-26_f8c9eca391fa577061d2b8c7396f4060_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

IMPHASH 4b091e841ac3b5360444cb711835d337
SHA256 7323acfec80890951519605076c2c71c5d95dbd69b3889fe654bb0b957652186
MD5 f8c9eca391fa577061d2b8c7396f4060
SHA1 a5088d5650c000fa4f4606e1106bfc825d405c62
SHA512 4a1be840e5cdcba6a8d079242a5f65cf905acb8549628ea917c855a64acc43946d0fed80053b31f369d0eaf7e46249396a2cfe4c2d0bc24f84aeb9c80906bc91
SSDEEP 49152:Lg3shpoawaz1sds5vFQUHR6KKMDPrRCscmo2nsG3AxeW/SzVyo:XwazJDAxGzD
TLSH
T1A9C53A16F64A65ACC15AC0B4834A8A73AA3534CE0B35B9FF05D446393FA9EF41F38719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1759376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ocrbench.pdb

kernel32

GetFileInformationByHandleEx SwitchToThread CreateFileW GetFileInformationByHandle FindFirstFileExW FindClose GetConsoleMode GetModuleHandleW FormatMessageW InitializeSListHead WaitForSingleObject GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW SetLastError GetFullPathNameW GetModuleHandleA GetCurrentThread QueryPerformanceFrequency SetThreadStackGuarantee AddVectoredExceptionHandler HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread QueryPerformanceCounter GetCurrentThreadId GetSystemInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetFileTime SetFileInformationByHandle SetFilePointerEx ReleaseMutex CreateMutexA GetCurrentProcessId LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte GetCurrentProcess lstrlenW HeapReAlloc HeapFree GetProcessHeap GetLocalTime CloseHandle SetUnhandledExceptionFilter GetModuleFileNameW GetSystemTimeAsFileTime FreeLibrary SetThreadErrorMode LoadLibraryExW GetLastError GetProcAddress

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile

vcruntime140

memcmp __C_specific_handler memset memcpy memmove __CxxFrameHandler3 __current_exception_context __current_exception _CxxThrowException

api-ms-win-crt-math-l1-1-0

roundf floorf ceilf sinf _hypotf atan2f cosf floor round powf __setusermatherr truncf

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

__p___argv _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _c_exit _initterm _initterm_e exit _exit _cexit _initialize_onexit_table _register_thread_local_exe_atexit_callback __p___argc terminate _crt_atexit _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_f8c9eca391fa577061d2b8c7396f4060_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic